@dypai-ai/mcp 1.7.9 → 1.7.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dypai-ai/mcp",
-  "version": "1.7.9",
+  "version": "1.7.10",
   "description": "DYPAI MCP Server — AI agent toolkit for building and deploying full-stack apps",
   "type": "module",
   "main": "src/index.js",

package/src/tools/sync/describe.js

@@ -10,6 +10,7 @@
  */
 
 import { proxyToolCall } from "../proxy.js"
+import { fetchRemoteCredentials } from "./remote-metadata.js"
 
 async function execSql(projectId, sql) {
   // Bypass remote execute_sql auto-LIMIT 20 so describe counts match reality.
@@ -59,7 +60,7 @@ export const dypaiDescribeTool = {
         LEFT JOIN system.endpoints_group g ON g.id = e.group_id
         ORDER BY e.name
       `),
-      execSql(project_id, "SELECT name, type FROM system.credentials ORDER BY name"),
+      fetchRemoteCredentials(project_id).catch(() => null),
       execSql(project_id, "SELECT name, description FROM system.roles ORDER BY name"),
       execSql(project_id, `
         SELECT id, name, public FROM storage.buckets ORDER BY name

package/src/tools/sync/planner.js

@@ -17,6 +17,7 @@ import {
   runEffectiveWorkflows,
 } from "../../lib/effective-workflows-runner.js"
 import { findEndpointNameCollisions } from "./endpoint-names.js"
+import { fetchRemoteCredentials } from "./remote-metadata.js"
 
 const ENDPOINT_NAME_RE = /^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/
 
@@ -195,7 +196,7 @@ export async function fetchRemoteState(projectId) {
       FROM system.endpoints
       ORDER BY name
     `)
-  const credentials = await execSql(projectId, "SELECT id, name, type FROM system.credentials")
+  const credentials = await fetchRemoteCredentials(projectId)
   const groups = await execSql(projectId, "SELECT id, name FROM system.endpoints_group")
 
   const mapsCtx = {

package/src/tools/sync/pull.js

@@ -22,6 +22,7 @@ import { api } from "../../api.js"
 import { serializeEndpoint } from "./codec.js"
 import { dumpPublicSchema } from "./schema-dump.js"
 import { findEndpointNameCollisions, findLegacyAliasEndpointNames } from "./endpoint-names.js"
+import { fetchRemoteCredentials } from "./remote-metadata.js"
 // Codegen was removed from v1 — the agent reads dypai/schema.sql + endpoint YAMLs
 // directly instead of relying on auto-generated TS types. The codegen.js file
 // still lives on disk in case we resurface it later with a leaner design.
@@ -817,7 +818,7 @@ export const dypaiPullTool = {
         FROM system.endpoints
         ORDER BY name
       `),
-      execSql(project_id, "SELECT id, name, type FROM system.credentials"),
+      fetchRemoteCredentials(project_id),
       execSql(project_id, "SELECT id, name FROM system.endpoints_group"),
       dumpPublicSchema(project_id),
       // Dump the global node catalog (central control plane) in one call.

package/src/tools/sync/remote-metadata.js

@@ -0,0 +1,40 @@
+import { proxyToolCall } from "../proxy.js"
+
+const CREDENTIAL_PAGE_SIZE = 50
+
+/**
+ * Read credential metadata through the dedicated, secret-safe MCP tool.
+ *
+ * `execute_sql` intentionally rejects system.credentials because that table
+ * also stores encrypted secret material. Sync only needs id/name/type, which
+ * get_app_credentials exposes without returning any secret values.
+ */
+export async function fetchRemoteCredentials(
+  projectId,
+  { call = proxyToolCall, pageSize = CREDENTIAL_PAGE_SIZE } = {},
+) {
+  const credentials = []
+  let offset = 0
+
+  while (true) {
+    const args = { limit: pageSize, offset }
+    if (projectId) args.project_id = projectId
+
+    const result = await call("get_app_credentials", args)
+    const page = Array.isArray(result?.credentials) ? result.credentials : []
+    credentials.push(...page)
+
+    const total = Number(result?.total)
+    if (
+      page.length === 0
+      || page.length < pageSize
+      || (Number.isFinite(total) && credentials.length >= total)
+    ) {
+      return credentials
+    }
+
+    offset += page.length
+  }
+}
+
+export const __testing = { CREDENTIAL_PAGE_SIZE }